Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm developing a standalone application using java, I have a Login screen, wherein user enters his username and password. For each instance of the application, user have to enter his credentials. From a usability standpoint, I thought of keeping a remember me check Button. My question is, as I am not using any database, how do I persist the user details. I have some rough thoughts, storing them in a property file and retrieving. I think there may be better approaches than the one I had. Any Ideas and suggestions?

share|improve this question
    
create a folder in %appdata% and store your stuff there –  ratchet freak Dec 13 '12 at 18:09
    
Are these for your app, or are they used against some service that requires auth? The answer below asserts you are authenticating against the app itself. –  C. Ross Dec 13 '12 at 20:33
    
Thanks C. Ross. I may have made an assumption. –  dsmith Dec 13 '12 at 23:31
    
I'm calling a web service, there these credentials are validated. –  srk Dec 14 '12 at 2:12
    
In that case, you cannot store passwords using cryptographic hash functions, since you will need to retrieve the clear password text. There are password managers like KeyPass and KeyPassX, but I believe they require a password to access, and may not have a Java API. If you do decide to store a file with the password in clear passwords, store it per-user under an access restricted directory. You haven't said what platforms you are supporting. Creating read-restricted files using Java7's java.nio.files is possible for POSIX based systems, but I'm not sure for Windows. –  dsmith Dec 16 '12 at 19:10

1 Answer 1

up vote 5 down vote accepted

It's not uncommon to store user credentials in a file. It is common to use a text file where each line is a delimited set of user credentials, like the following.

user123:s8Z6dRBXxNHsh+qBLz1Tuw==
user789:EQrcOUm6Wau+VuBX8g+IPg==

The format is not important, but it is good practice to avoid storing clear-text passwords. The credentials above use a cryptographic hash function that generates an "irreversible" byte array, which is then Base64 encoded to reduce it to ASCII characters. This is known as a "password digest". When a person enters their password, it is first converted to the digest form which is then compared with the stored digest.

SHA1 is the recommended hash function, and I use Base64 because it it produces smaller digests that hex encoding. Here's some sample code:

import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import org.apache.commons.codec.binary.Base64;

public class TestAnything {

   public static void main(String[] args) {
      try {
         System.out.println(pwdDigest("coverme"));
      }
      catch(NoSuchAlgorithmException e) {
          e.printStackTrace();
      } catch (UnsupportedEncodingException e) {
         e.printStackTrace();
      } 
   }

   static String pwdDigest(String password) throws NoSuchAlgorithmException,  UnsupportedEncodingException {
      MessageDigest md = MessageDigest.getInstance("SHA-1");
      byte[] digestBytes = md.digest(password.getBytes("UTF-8"));
      return new String(Base64.encodeBase64(digestBytes), "ASCII");
   }
}

It is also important where you store this file. Simply hashing your password is not a sufficient means of protecting your data. The credentials file should be inaccessible to the end user. Although SHA-1 is irreversible algorithmically, it is susceptible to brute-force and rainbow-table attacks, and therefore must remain securely stored. Especially for weak passwords.

Presumably, you are using a password because you are protecting some data or resource that the user would otherwise not have access to. There is no sense password protecting an application if there is no data, or if the data is otherwise accessible to the user from the file system. So I'm not sure what you are protecting -- you say you have no data-base.

If you are protecting data on the local file-system, and it is only accessible to one user, I would suggest encrypting the data using an AES cipher and using the user's password digest as the encryption key. The draw-back to this is that the user can never change their password.

If you are protecting data on a shared file-system, or a time-share PC, data should probably be stored in an access controlled directory and accessed using some asymmetric key system like RSA.

If you are protecting access to a remote service, the passwords should be stored on the remote system.

So we really need to know what you are protecting.

share|improve this answer
1  
Don't forget to apply a salt before hashing the password. To stop lookup attacks on weak passwords. –  mike30 Dec 13 '12 at 20:31
    
Yes, salting is always a good idea to deal with rainbow-tables. Cheers. –  dsmith Dec 13 '12 at 20:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.